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ABSTRACT 

In  this  paper,  a  bank  of  Kalman  filters  is  applied  to  aircraft  gas 
turbine  engine  sensor  and  actuator  fault  detection  and  isolation  (FDI) 
in  conjunction  with  the  detection  of  component  faults.  This  approach 
uses  multiple  Kalman  filters,  each  of  which  is  designed  for  detecting  a 
specific  sensor  or  actuator  fault.  In  the  event  that  a  fault  does  occur, 
all  filters  except  the  one  using  the  correct  hypothesis  will  produce 
large  estimation  errors,  thereby  isolating  the  specific  fault.  In  the 
meantime,  a  set  of  parameters  that  indicate  engine  component 
performance  is  estimated  for  the  detection  of  abrupt  degradation.  The 
proposed  FDI  approach  is  applied  to  a  nonlinear  engine  simulation  at 
nominal  and  aged  conditions,  and  the  evaluation  results  for  various 
engine  faults  at  cruise  operating  conditions  are  given.  The  ability  of 
the  proposed  approach  to  reliably  detect  and  isolate  sensor  and 
actuator  faults  is  demonstrated. 


NOMENCLATURE 

A16  Variable  bypass  duct  area 

A8  Nozzle  area 

BST  Booster 

CLM  Component  Level  Model 

FAN  Fan 

FDI  Fault  detection  and  isolation 

FOD  Foreign  object  damage 

HPC  High-pressure  compressor 

HPT  High-pressure  turbine 

LPT  Low-pressure  turbine 

P27  HPC  inlet  pressure 

PS15  Bypass  duct  static  pressure 

PS3  Combustor  inlet  static  pressure 

PS56  LPT  exit  static  pressure 

T27D  Booster  inlet  temperature 

T56  LPT  exit  temperature 


TMPC 

Burner  exit  heat  soak 

WF36 

Fuel  flow 

XN2 

Low-pressure  spool  speed,  measured 

XN25 

High-pressure  spool  speed,  measured 

XNH 

High-pressure  spool  speed,  state  variable 

XNL 

Low-pressure  spool  speed,  state  variable 

INTRODUCTION 

Fault  detection  and  isolation  (FDI)  logic  plays  a  critical  role  in 
enhancing  the  safety  and  reliability  and  reducing  the  operating  cost  of 
aircraft  propulsion  systems.  However,  achieving  the  FDI  task  with 
high  reliability  is  a  challenging  problem.  Faults  may  occur  in  various 
degrees  of  severity  at  various  locations;  therefore  numerous  fault 
scenarios  are  possible.  Moreover,  the  engine’s  complex  structure  and 
harsh  operating  environment  make  interpretation  of  the  available 
information  difficult.  To  deal  with  such  problems,  the  introduction  of 
analytical  redundancy  has  become  common  and  is  considered  more 
cost-effective  than  hardware  redundancy.  With  the  increase  of  digital 
computational  power,  more  sophisticated  approaches  such  as  the 
utilization  of  an  on-board  engine  model  have  become  possible. 

When  a  fault  occurs,  the  first  step  is  to  detect  it  as  soon  as  possible 
so  that  the  scenario  of  a  minor  fault  escalating  to  a  more  serious  failure 
can  be  avoided.  The  approach  commonly  used  for  model-based  fault 
detection  is  composed  of  two  steps:  1)  generate  residual  signals  from 
the  sensor  measurements  and  their  estimated  values,  and  then  2) 
compare  the  residuals  with  thresholds  to  make  fault  detection 
decisions  [1],  Sensor  noise  and  modeling  uncertainty  are  key  factors 
that  affect  detection  performance.  A  fault  signature  contained  in  the 
measurements  is  often  corrupted  by  sensor  noise,  and  un-modeled 
engine  dynamics  may  generate  a  fault-like  signature.  These  factors 
lead  to  missed  detections  and  false  alarms.  To  reduce  the  effects  of 
noise,  the  sensor  measurements  can  be  averaged  over  a  given  length  of 
time.  Although  this  approach  may  remove  spike-like  fault  signatures, 
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it  can  retain  fault  information  which  spans  a  period  of  time.  To  deal 
with  modeling  uncertainty,  robust  detection  approaches  have  been 
investigated  by  some  researchers  [2,3].  In  the  robust  design  approach, 
modeling  uncertainty  is  accounted  for  in  the  residual  generation 
process.  Therefore,  fault  detection  logic  can  be  sensitive  to  faults 
while  being  robust  to  modeling  uncertainty. 

Once  a  fault  is  successfully  detected,  die  next  step  is  to  isolate  the 
particular  fault  from  other  potential  faults.  A  single  fault  isolation 
technique  for  aircraft  engine  performance  diagnostics  was  investigated 
by  Volponi  et  al.  [4].  Assuming  that  a  fault  has  already  been  detected, 
this  approach  processed  Kalman  filter  equations  iteratively  for  each  of 
the  root  causes  under  consideration  and  subsequently  ranked  fault 
candidates  in  order  of  likelihood  based  on  the  estimation  error  norms. 
The  application  of  a  bank  of  estimators  for  fault  detection  and  isolation 
was  conducted  by  Merrill  et  al.  [5],  Duyar  et  al.  [6],  and  Menke  et  al. 
[7],  This  approach  uses  multiple  estimators,  each  of  which  is  designed 
for  detecting  a  specific  fault.  Since  each  estimator  is  designed  based 
on  a  specific  hypothesis  (such  as  the  failure  of  a  single  sensor  or 
actuator),  all  the  estimators  except  the  one  using  the  correct  hypothesis 
will  produce  large  estimation  errors  when  a  fault  occurs.  By 
monitoring  the  residual  of  each  estimator,  the  specific  fault  that  has 
occurred  can  be  detected  and  isolated. 

The  use  of  a  bank  of  Kalman  filters  for  addressing  aircraft  engine 
sensor  failures  was  investigated  by  NASA’s  Advanced  Detection, 
Isolation,  and  Accommodation  (ADIA)  Program  during  the  1980’s  [5]. 
This  program  successfully  demonstrated  improved  control  loop 
tolerance  to  sensor  failures  (bias  and  drift)  using  the  aforementioned 
analytical  technique.  It  did  not,  however,  address  robustness  issues  in 
the  presence  of  engine  degradation  or  other  faults.  Over  their  lifetime 
of  operation,  engine  components  will  undergo  some  amount  of 
degradation.  This  degradation  may  be  gradual  or  abrupt  as  in  the  case 
of  foreign  object  damage.  If  abrupt  component  degradation  has 
occurred,  a  sensor  FDI  system  may  generate  a  false  alarm.  Similarly, 
an  actuator  failure  may  cause  a  false  alarm  or  missed  detection  if  not 
considered.  In  the  new  framework,  actuator  and  component  faults  are 
accounted  for  to  expand  the  FDI  capability. 

The  proposed  FDI  approach  is  applied  to  a  nonlinear  engine 
simulation  and  evaluated  for  various  engine  faults  at  cruise  operating 
conditions.  In  order  to  mimic  the  real  engine  environment,  the 
nonlinear  simulation  is  executed  not  only  at  the  nominal,  or  healthy, 
condition  but  also  at  an  aged  condition.  Although  the  effectiveness  of 
the  FDI  system  is  impacted  by  aging  engine  effects,  a  simple  approach 
to  recover  the  performance  is  discussed  and  evaluated. 

DEVELOPMENT  OF  FAULT  DETECTION  AND  ISOLATION 
LOGIC 

A  depiction  of  the  FDI  logic  integrated  with  the  propulsion  system 
is  shown  in  Fig.  1.  The  FDI  logic  uses  two  sets  of  input  signals: 
sensor  measurements  and  control  commands.  Sensor  measurements 
are  corrupted  by  noise  and  may  be  faulty  due  to  sensor  failure. 
Actuators  may  also  experience  mechanical  and/or  electrical  failures. 
As  shown  in  Fig.  1,  the  FDI  logic  uses  control  commands  (ucrJ). 
Alternatively,  the  true  actuator  positions  ( Utme )  may  be  directly 
measured,  and  the  sensed  values  may  be  used  by  the  FDI  logic. 
However,  using  sensed  actuator  positions  would  add  complexity  to  the 
FDI  problem,  since  an  actuator  fault  can  happen  not  only  to  an 
actuator  itself  but  also  to  an  actuator  position  feedback  sensor. 
Therefore,  an  actuator  fault  is  simply  defined  as  an  inconsistency 
between  true  actuator  position  and  control  command.  The  sensor  and 
actuator  failures  dealt  with  in  this  paper  are  so-called  “soft”  failures. 
Soft  failures  are  defined  as  inconsistencies  between  true  and  measured 


Component 

Actuator  Fault  Fault  Sensor  Fault 


In-flight  FDI 

•  Sensor/actuator  fault  detection  and  isolation 

•  Detection  of  abrupt  component  degradation 


Figure  1.  Propulsion  System  with  Fault  Detection 
and  Isolation  Logic 


sensor  values  (or  true  and  commanded  actuator  values)  that  are 
relatively  small  in  magnitude  and  thus  difficult  to  detect  by  a  simple 
range-checking  approach,  whereas  “hard”  failures  are  larger  in 
magnitude  and  thus  more  readily  detectable.  Soft  failures  can  take 
different  forms  such  as  a  fixed  scalar,  a  fixed  bias,  a  drift,  or 
intermittent  spikes.  Among  these  failures,  fixed  bias  is  investigated  in 
this  study,  although  the  proposed  approach  can  be  applied  to  time- 
varying  soft  failures  as  well. 

In  the  development  of  the  FDI  logic,  it  is  assumed  that  only  one  of 
the  sensors  or  actuators  will  fail  at  a  time.  Multiple  sequential  and 
multiple  simultaneous  failures  are  not  addressed  in  this  paper.  The 
likelihood  of  multiple  simultaneous  failures  is  considered  to  be  very 
low.  To  handle  multiple  sequential  failures,  a  hierarchical  fault 
isolation  structure,  as  demonstrated  by  Menke  et  al.  [7],  must  be  added 
to  the  proposed  FDI  logic.  In  the  following  sections,  the  approach  for 
sensor  and  actuator  FDI  in  conjunction  with  component  fault  detection 
is  discussed. 


Component  Performance  Analysis 

Engine  component  performance  is  represented  by  a  set  of  so-called 
health  parameters.  The  health  parameters  deviate  from  initial  healthy 
baseline  values  as  the  components  degrade;  therefore  they  are  an 
indicator  of  the  engine  internal  condition.  A  linear  engine  model 
under  consideration  is  represented  by  the  following  state- space 
equations: 

x  —  Ax  +  Lh  + 
y  -  Cx  +  Mh  +  Ducmd  +  v 

where  the  vectors  x,  h ,  ucmd  represent  state  variables,  health 
parameters,  and  control  variables,  respectively.  The  sensor  A 
measurement  vector,  y,  is  corrupted  by  the  sensor  noise  vector,  v.  The 
matrices  A,  B,  C,  A  L,  and  M  have  appropriate  dimensions.  The 
influence  of  health  parameters  on  an  engine  is  similar  to  that  of  the 
control  variables,  however,  the  health  parameters  are  not  measurable 
and  are  thus  treated  as  a  part  of  the  augmented  state  to  be  estimated. 
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In  the  Kalman  filter  problem  setup,  the  engine  state  vector  is 
augmented  with  health  parameters  as  follows  [8]: 


x  =  Ax  +  Bucmd  +  w 
y^Cx  +  Du^  +v 


(2) 


where 


x  = 


X 

'A 

Ll 

,B  = 

r*i 

h_ 

,A  = 

0 

1 

o 

i - 

o 

i _ 

,c  =  [c  m] 


and  w  and  v  are  the  process  and  sensor  noise,  respectively.  They  are 
uncorrelated,  white  noise  with  the  following  covariance  matrices: 


M.t  +  T)wT(t 
v(t  +  r)vT  (t) 


]=QS(t) 

=  RS(r) 


(3) 


y  Ucmd 

Figure  2.  Structure  of  Bank  of  Kalman  Filters 


The  Kalman  filter  has  the  following  structure: 

xe  =  Axe  +  +  K(y  -  ye  ) 

ye  =  Cxe  +  Du  end 


(4) 


From  this  residual,  a  weighted  sum  of  squared  residual  (WSSR)  is 
computed: 

WSSR*  =Wri(eif(liy1ei  (6) 


where  xe  and  ye  are  the  estimates  of  augmented  state  vector  and 

sensor  measurements,  respectively,  and  K  is  a  Kalman  gain  matrix.  In 
general,  the  matrix  R  is  derived  from  available  sensor  noise 
characteristic  data  while  the  matrix  Q  is  tuned  for  obtaining  a  desired 
Kalman  gain.  In  order  for  the  Kalman  filter  to  converge,  the  matrix 

pair  (A,C)  must  be  observable.  Moreover,  the  current  problem  setup 
requires  the  number  of  health  parameters  in  the  augmented  state  vector 
to  be  less  than  or  equal  to  the  number  of  sensor  measurements  [9]. 
The  above  state-augmented  approach  is  used  for  designing  a  bank  of 
Kalman  filters. 


Sensor  Fault  Detection 

The  bank  of  Kalman  filters  for  sensor  fault  detection  and  isolation, 
shown  in  Fig.  2,  contains  m  Kalman  filters  where  m  is  the  number  of 
sensors  being  monitored.  Each  filter  estimates  the  augmented  state 
vector  discussed  in  the  previous  section  using  (m-1)  sensors.  The 
sensor  which  is  not  used  by  a  particular  filter  is  the  one  being 
monitored  by  that  filter  for  fault  detection.  For  instance,  the  i*  filter 
uses  the  sensor  subset  y*  that  excludes  the  Ith  sensor,  where  i  is  an 
integer  from  1  to  m.  In  the  event  that  sensor  #/  is  faulty,  all  filters  will 
use  a  corrupted  measurement,  except  for  filter  #/.  Consequently,  filter 
#/  is  able  to  estimate  the  augmented  state  vector  from  fault-free  sensor 
measurements,  whereas  the  estimates  of  the  remaining  filters  are 
distorted  by  the  fault  in  sensor  #i. 

After  the  estimation  of  augmented  state  variables,  the  sensor 
measurement  estimates  are  constructed  as  described  in  Eq.  (4).  In 
order  to  evaluate  the  accuracy  of  the  state  estimation,  the  following 
residual  vector  is  generated  for  each  filter: 

e'^yi-y*  (5) 


where 

S’  =diag[aif 

The  vector  d  represents  the  standard  deviations  of  the  iA  sensor- 
subset,  and  it  normalizes  the  residual  vector.  The  additional  weight  Wr 
is  a  scalar,  and  it  is  selected  so  that  the  value  of  the  WSSR  signal  will 
be  less  than  a  given  threshold  under  the  normal  condition  where  all 
sensors  are  fault  free.  The  scalar  Wr  is  a  tuning  parameter  that 
influences  the  FDI  performance.  If  the  weight  Wr  is  too  small,  the 
increase  in  WSSR  due  to  a  faulty  sensor  will  not  be  observed,  causing 
missed  detections.  On  the  other  hand,  if  this  scalar  is  too  large,  the 
WSSR  signal  will  be  too  sensitive  to  sensor  noise  and  modeling 
uncertainty  and  may  generate  false  alarms.  The  fault  indicator  signal 
(i.e.,  WSSR)  in  Eq.  (6)  will  be  compared  against  the  detection 
threshold  in  order  to  detect  a  sensor  fault. 


Actuator  Fault  Detection 

Actuator  FDI  is  more  challenging  than  sensor  FDI  in  model-based 
estimation  approaches,  hi  the  general  Kalman  filter  approach,  it  is 
assumed  that  the  actuators  are  properly  configured  to  the  positions  that 
a  control  system  demands,  thus  any  engine  responses  to  actuator 
perturbations  are  cancelled  out  in  the  estimation  loop.  However,  if  a 
large  discrepancy  between  commanded  and  true  actuator  positions 
does  exist  due  to  an  actuator  fault,  it  can  result  in  significant  state 
estimation  errors.  In  this  paper,  an  actuator  fault  is  modeled  as  a  bias, 
which  results  in  an  inconsistency  between  an  actuator  command  used 
as  a  Kalman  filter  input  and  a  true  actuator  position  under  which  the 
engine  is  operating. 

To  account  for  a  potential  bias,  the  following  linear  engine  model  is 
used  in  the  actuator  FDI  design  approach: 
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x  =  Ax  +  Lh  +  B(ucmc,  +  b ) 
y  =  Cx  +  Mh  +  D(ucmd  +fc)+v 


(7) 


em+k=yk-y 


(9) 


Equation  (7)  shows  the  actuator  bias  vector  b  added  to  the  actuator 
command  inputs. 

A  bank  of  Kalman  filters  is  also  applied  for  the  actuator  FDI  though 
its  structure  will  be  different  from  that  of  the  sensor  FDI.  Unlike  the 
sensor  FDI  approach  where  each  filter  excludes  one  sensor  from  the 
sensor  suite,  each  filter  in  the  actuator  FDI  will  use  all  m  sensors  and 
estimate  an  augmented  state  vector,  which  includes  an  actuator  bias. 
Similar  to  the  sensor  FDI  approach,  the  engine  state  variables  in  Eq. 
(1)  are  augmented  with  the  health  parameters  and,  in  addition,  one 
actuator  bias.  For  the  bias  estimation  of  the  actuator,  the  following 
model  equation  is  used: 


xk  =  Aixk+Bucmd+w 
yk  =ckxk  +Ducmd+v 


(8) 


where 


['1 

' A  L  V 

B 

l 

_ 1 

,Ak  = 

0  0  0 

0  0  0 

,B  = 

0 

0 

,Ck  =  [C  M  Dk\ 


and  A  is  an  integer  from  1  to  p,  where  p  is  the  number  of  actuators. 
The  scalar  bk  is  a  bias  in  the  lr  actuator,  and  the  vectors  Bk  and  Dk  are 
the  A*  columns  of  B  and  D  matrices,  respectively.  Based  on  the  above 
state-space  structure,  a  Kalman  filter  for  each  actuator  is  designed 
using  Eqs.  (3)  and  (4). 

After  the  estimation  of  the  augmented  state  variables  and  sensor 
measurements,  a  fault  indicator  signal  is  generated  for  each  filter 
similar  to  the  sensor  FDI  approach.  The  residual  signal  of  the  (m+ A)4 
filter  is  given  as: 


where  the  vector  y\  is  the  sensor  estimates  generated  by  the  (m+kf1 
filter.  From  this  signal,  the  following  weighted  sum  of  squared 
residual  (WSSR)  is  generated: 


where 


WSSRm+k  =  Vk  (em+k  f  (E)-1  e 


S  =  diag[a]2 


m+k 


(10) 


The  vector  cr  is  the  noise  standard  deviation,  and  the  scalar  Vr  is  a 
weighting  factor  for  the  FDI  performance  trade  off.  The  fault 
indicator  signal  (WSSR)  in  Eq.  (10)  will  be  compared  against  a  given 
detection  threshold  in  order  to  detect  an  actuator  fault.  When  an 
actuator  is  biased,  all  filters  use  corrupted  information,  however,  the 
one  filter  with  the  correct  hypothesis  is  able  to  accommodate  it. 
Therefore,  this  particular  filter  will  maintain  a  low  residual  value  and 
consequently  can  be  isolated  from  the  rest  of  the  filters. 


Integration  of  Bank  of  Kalman  Filters  with  Fault  Isolation 
Logic 

The  overall  architecture  of  the  FDI  system  is  shown  in  Fig.  3.  The 
functionality  of  the  bank  of  Kalman  filters  with  an  augmented  state 
vector  is  summarized  as  follows. 

1)  When  there  is  no  sensor  or  actuator  fault,  with  or  without 
component  faults,  all  Kalman  filters  should  retain  low  fault 
indicator  signals,  indicating  there  is  no  sensor/actuator  fault, 
and  should  generate  accurate  health  parameter  estimates. 

2)  When  one  of  the  sensors  or  actuators  failed,  with  or  without 
component  faults,  only  the  one  filter  with  the  correct 
hypothesis  should  generate  a  low  fault  indicator  signal  and 
accurate  health  parameter  estimates. 


Figure  3.  FDI  System  Architecture 
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Hie  fault  indicator  signals  generated  by  the  above  approach  must  be 
further  processed  in  order  to  identify  a  fault.  The  FDI  process  can  be 
completed  by  integrating  the  bank  of  Kalman  filters  with  fault 
isolation  logic  as  shown  in  Fig.  3.  In  general,  fault  isolation  logic  is 
constructed  from  detection  thresholds  and  decision  rules.  The  decision 
rules  check  for  fault  indicator  signal  violation  of  the  pre-established 
detection  thresholds.  If  the  necessary  rules  for  the  existence  of  a  fault 
are  satisfied,  then  the  fault  isolation  logic  declares  a  fault.  Fault 
isolation  is  achieved  if  a  fault  is  declared  for  all  the  fault  indicator 
«  signals  except  for  the  one  corresponding  to  a  correct  fault  hypothesis. 
The  development  of  fault  isolation  logic  is  application-dependent.  An 
example  will  be  given  in  the  following  section  where  the  FDI  design 
methodology  is  applied  to  an  aircraft  engine  model. 


APPLICATION  OF  FDI  METHODOLOGY  TO  AN  AIRCRAFT 
ENGINE 

In  this  section,  the  FDI  design  methodology  is  applied  to  an  aircraft 
engine  model.  A  description  of  the  engine  model  will  be  given, 
followed  by  a  description  of  the  fault  isolation  logic  development. 


Engine  Model 

The  engine  model  used  in  the  current  research  is  the  nonlinear 
simulation  of  an  advanced  military  twin-spool  turbofan  engine  [10]. 
This  simulation  is  constructed  as  a  Component  Level  Model  (CLM), 
which  assembles  the  major  components  of  an  aircraft  engine.  Engine 
performance  deterioration  is  modeled  by  adjustments  to  efficiency 
and/or  flow  coefficient  scalars  of  the  following  five  components:  Fan 
(FAN),  Booster  (BST),  High-Pressure  Compressor  (HPC),  High- 
Pressure  Turbine  (HPT),  and  Low-Pressure  Turbine  (LPT).  These 
scalars  representing  the  component  performance  deterioration  are 
referred  to  as  health  parameters.  The  actuator  dynamics  are  much 
faster  than  the  engine  dynamics.  The  engine  state  variables,  health 
parameters,  actuation  variables,  and  sensor  measurements  used  in  the 
current  research  are  shown  in  Table  1. 


Table  1,  State,  Health,  Actuator,  and  Sensor  Variables 


State  Variables 

XNL,  XNH,  TMPC 

Health 

Parameters 

FAN  efficiency,  FAN  flow  capacity 

BST  efficiency,  BST  flow  capacity 

HPC  efficiency,  HPC  flow  capacity 

HPT  efficiency,  HPT  flow  capacity 

LPT  efficiency,  LPT  flow  capacity 

Actuators 

WF36,  A8,  A16 

Sensors 

XN2,  XN25,  T27D,  T56,  PS15,  P27,  PS3, 
PS56 

In  this  paper,  the  standard  deviations  of  the  sensor  noise  shown  in 
Table  2  are  used.  These  numbers  are  rough  estimates  derived  from  Lu 
et  al.  [1 1].  Information  regarding  sensor  accuracy  can  be  also  found  in 
Pinelli  et  al.  [12]. 

An  assumption  is  made  in  this  application  problem.  It  is  assumed 
v,  that  the  first  four  health  parameters  (FAN  and  BST  efficiency  and  flow 
capacity  scalars)  in  Table  1  are  sufficient  to  represent  component 
faults  of  interest  during  a  flight.  The  health  parameters  represent 
engine  internal  condition.  These  parameters  deviate  from  initial 
1  healthy  baseline  values  over  time  due  to  gradual  degradation  (aging 
phenomenon)  and  possibly  abrupt  degradation  (fault).  The  focus  of 
the  current  research  is  the  detection  of  faults  rather  than  the  trending  of 


Table  2.  Sensor  Noise  Standard  Deviation  in  %  of  the 
Nominal  Engine  Trim  Values 


Sensor 

a 

XN2 

0.25 

XN25 

0.25 

T27D 

0.50 

T56 

0.50 

PS15 

0.50 

P27 

0.50 

PS3 

0.50 

PS56 

0.50 

component  performance  deterioration  due  to  aging.  The  four  health 
parameters  are  used  to  represent  an  abrupt,  moderate  degradation  due 
to  foreign  object  damage  (FOD),  as  done  by  Kerr  et  al.  [13].  The 
detection  of  such  component  faults  is  achieved  by  accurately 
estimating  those  selected  health  parameters.  Therefore,  they  are 
included  in  the  augmented  state  vector  and  estimated  as  described  by 
Eqs.  (2)  through  (4).  The  selection  of  the  four  health  parameters  was 
based  upon  their  correlation  to  FOD  events  and  the  relative  likelihood 
of  an  engine  experiencing  FOD  versus  other  possible  abrupt 
component  degradations  during  a  flight.  If  alternative  faults  are 
known  to  be  more  probable,  the  FDI  system  can  be  re-designed  using 
those  health  parameters  which  correlate  to  the  faults  of  interest.  The 
design  constraint  is  that  the  selected  health  parameters  must  be 
observable  through  the  given  sensor  suite. 


Development  of  Fault  Isolation  Logic 

In  order  to  isolate  a  fault  using  the  bank  of  Kalman  filters  developed 
in  the  previous  sections,  fault  isolation  logic  must  be  developed.  This 
decision-making  logic  is  discussed  in  this  section  in  the  context  of  a 
simulated  example.  Consider  an  example  in  which  the  fault  indicator 
signal  generation  process  in  Fig.  3  is  applied  to  the  nonlinear  engine 
simulation  for  a  scenario  where  all  the  sensors  and  actuators  remain 
fault  free.  Figure  4  shows  the  fault  indicator  signals  (WSSR)  for  the 
selected  FDI  filters;  these  signals  have  been  filtered  through  a  low- 
pass  filter  with  a  cutoff  frequency  of  1.0  rad/sec.  The  noise  in  the 
sensor  measurements  is  quite  significant  and  causes  large  variations  in 
the  health  parameter  estimates  and  the  fault  indicator  signals. 


Figure  4.  Fault  Indicator  Signals  of  Select  FDI  Filters 
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Two  factors  that  are  of  main  concern  in  developing  the  fault 
isolation  logic  are  false  alarms  and  missed  detections.  Reducing  one 
of  these  factors  often  causes  an  increase  in  the  other.  To  illustrate  how 
the  isolation  logic  affects  false  alarms  and  missed  detections,  assume 
that,  in  the  current  case,  a  fault  is  declared  for  an  FDI  filter  when  the 
corresponding  fault  indicator  signal  exceeds  a  given  detection 
threshold.  If  the  detection  threshold  is  set  at  the  value  of  one,  all  of  the 
fault  indicator  signals  in  Fig.  4  exceed  the  detection  threshold; 
therefore  multiple  false  alarms  would  have  occurred.  To  avoid  such 
false  alarms,  two  options  are  possible:  1)  increase  the  detection 
threshold  value,  or  2)  smooth  the  fault  indicator  signals  by  modifying 
the  bandwidth  of  the  low-pass  filter.  Both  options,  however,  may 
cause  missed  detections.  A  fault  may  result  in  a  shift  in  the  mean 
value  of  some  fault  indicator  signals  without  any  spike-like  responses. 
In  such  a  case,  a  failure  scenario  will  go  undetected  until  the 
magnitude  of  the  fault  becomes  severe  enough  to  reach  the  higher 
threshold.  Also,  reducing  the  bandwidth  of  the  low-pass  filter  will 
eliminate  any  spike-like  fault  signatures  in  die  fault  indicator  signals, 
making  such  failures  more  difficult  to  detect. 

In  the  current  study,  a  modified  approach  for  fault  isolation  is 
developed  in  order  to  reduce  false  alarms  and  missed  detections  as 
much  as  possible.  First  of  all,  the  fault  indicator  signals  of  all  11 
Kalman  filters  are  averaged  over  non-overlapping,  ten-second 
intervals.  For  sensor  FDI  filters,  two  thresholds  are  used:  the  first 
threshold  is  set  at  the  value  of  one,  and  the  second  is  set  at  the  value  of 
two.  A  fault  is  declared  if  the  ten-second  averaged  fault  indicator 
signal  exceeds  the  first  threshold  three  consecutive  times,  or  if  the 
non-averaged  fault  signal  exceeds  the  second  threshold.  The  first  rule 
(using  the  averaged  signal)  addresses  a  mean  value  shift  of  the  fault 
indicator  signal  that  is  sustained.  This  rule  results  in  a  minimum  fault 
identification  time  of  30  seconds.  The  second  rule  (using  the  non- 
averaged  signal)  obviously  takes  into  account  spike-like  fault 
signatures.  The  second  threshold  is  set  high  enough  so  that  sensor 
noise  or  modeling  uncertainty  will  not  cause  the  fault  indicator  signal 
to  exceed  it. 

For  actuator  FDI  filters,  only  one  threshold,  set  at  the  value  of  one, 
is  used.  A  fault  is  declared  if  the  ten-second  averaged  fault  indicator 


signal  exceeds  the  threshold  four  consecutive  times.  The  reason  for 
applying  a  different  rule  for  actuator  failures  is  as  follows.  For 
actuator  FDI,  the  response  of  the  “correct”  Kalman  filter  is  influenced 
by  an  actuator  bias,  whereas  a  sensor  bias  does  not  influence  the 
response  of  the  “correct”  filter  for  sensor  FDI.  When  an  actuator  is 
biased,  the  actuator  position  estimated  by  the  “correct”  Kalman  filter 
initially  follows  the  control  command,  indicating  that  there  is  no  bias. 
After  going  through  this  initial  error  phase,  the  estimated  position 
starts  converging  to  the  true  actuator  position.  This  initial  estimation 
error  can  be  huge  depending  on  the  bias  magnitude.  Therefore,  spike¬ 
like  signatures,  which  could  be  generated  by  both  “correct”  and 
“wrong”  filters,  cannot  be  used  as  an  actuator  fault  indicator. 
Moreover,  the  initial  estimation  error  transient  of  the  “correct”  Kalman 
filter  may  result  in  high  residuals  which  persist  for  longer  periods  than 
in  the  sensor  FDI  case.  To  account  for  this  fact,  the  detection 
threshold  must  be  violated  four  consecutive  times  before  declaring  a 
fault,  instead  of  three  times  as  for  the  sensor  FDI. 

Fault  isolation  is  successfully  achieved  when  the  fault  isolation 
logic  detects  a  fault  in  all  filters  except  for  the  one  “correct”  filter.  If  a 
“wrong”  filter  is  isolated,  it  is  considered  a  false  alarm.  If  the  isolation 
logic  detects  a  fault  in  at  least  one  filter,  but  multiple  filters  indicate 
no-fault,  it  means  that  a  fault  was  detected  but  not  isolated.  FDI 
performance  depends  on  the  decision  rules  and  the  values  of  the 
detection  thresholds.  They  are  adjusted  by  the  designer  in  order  to 
meet  the  desired  system  performance  requirements. 


PERFORMANCE  EVALUATION  OF  THE  FDI  SYSTEM 

The  performance  of  the  FDI  system  is  evaluated  in  this  section  by 
applying  it  to  the  nonlinear  engine  simulation  trimmed  at  a  cruise 
operating  point.  The  FDI  performance  is  evaluated  based  on  the 
minimum  sensor/actuator  bias  magnitude  which  can  be  isolated,  and 
the  accuracy  of  health  parameter  estimates.  Multiple  scenarios  are 
considered  to  ensure  that  the  FDI  system  does  not  identify  any 
component  faults  as  a  sensor  or  actuator  fault.  To  capture  a  range  of 
expected  component  faults,  the  eight  scenarios,  shown  in  Table  3  with 
health  parameter  and  control  command  perturbation  magnitude  and 


Table  3.  Engine  Operation  Scenarios  for  Evaluation  of  the  FDI  System 


Scenario 

# 

~  _ —+* - 1 — - - - _____ — _ — , — - 

Perturbation  Description  (magnitude  and  step  time) 

FAN 

efficiency 

FAN 

flow 

BST 

efficiency 

BST 

flow 

WF36 

A8 

A16 

1 

0 

0 

0 

0 

0 

0 

0 

2 

0 

0 

0 

0 

2% 

at  5  sec 

-1% 
at  8  sec 

-3% 
at  7  sec 

3 

-1% 
at  5  sec 

-1% 
at  6  sec 

-1% 

at  10  sec 

-1% 

at  12  sec 

0 

0 

0 

4 

-1% 
at  5  sec 

-1% 
at  6  sec 

-1% 

at  10  sec 

-1% 

at  12  sec 

2% 

at  20  sec 

-1% 

at  23  sec 

-3% 

at  22  sec 

5 

-2% 
at  5  sec 

-2% 
at  6  sec 

-2% 

at  10  sec 

-2% 

at  12  sec 

0 

0 

0 

6 

-2% 
at  5  sec 

-2% 
at  6  sec 

-2% 

at  10  sec 

-2% 

at  12  sec 

2% 

at  20  sec 

-1% 

at  23  sec 

-3% 

at  22  sec 

7 

-3% 
at  5  sec 

-3% 
at  6  sec 

-3% 

at  10  sec 

-3% 

at  12  sec 

0 

0 

0 

8 

-3% 
at  5  sec 

-3% 
at  6  sec 

-3% 

at  10  sec 

-3% 

at  12  sec 

2% 

at  20  sec 

-1% 

at  23  sec 

-3% 

at  22  sec 
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injection  time  information,  are  investigated.  In  the  simulation,  these 
perturbations  are  injected  as  step  changes  at  the  specified  time.  The 
perturbations  in  the  four  health  parameters  represent  abrupt  component 
degradation  due  to  a  FOD  event.  Since  field  data  indicating  actual 
component  degradation  profiles  due  to  FOD  was  not  available,  the 
magnitudes  and  injection  times  were  selected  arbitrarily.  Likewise, 
control  command  perturbations  were  selected  arbitrarily  to  represent 
operation  around  the  fixed  operating  point.  As  shown  in  Table  3, 
multiple  health  parameters  are  perturbed  in  order  to  introduce  the 
nonlinear  effects  on  the  engine  simulation  outputs.  The  control 
command  perturbations  disturb  the  engine  operating  point;  however, 
they  must  not  cause  a  false  alarm. 


were  averaged  over  100  seconds.  Note  that  this  FDI  filter  constructs 
the  sensor  bias  estimate  from  the  estimated  state  variables.  As 
expected,  the  deviations  in  all  10  health  parameters  (baseline 
degradation)  for  condition  #2  are  incorrectly  attributed,  or  “smeared,” 
to  the  four  health  parameters  being  estimated,  resulting  in 
unacceptable  health  estimation.  A  similar  result  was  observed  in  real 
engine  testing  conducted  by  Luppold  et  al.  [15].  Moreover,  the  overall 
sensor/actuator  FDI  performance  appeared  to  vary  with  the  baseline 
condition:  none  of  the  FDI  filters  declared  a  fault  for  the  baseline 
condition  #1,  whereas  all  11  FDI  filters  declared  a  fault  for  the 
baseline  condition  #2.  This  example  demonstrates  the  sensitivity  of 
the  FDI  system,  which  is  designed  based  on  a  healthy  engine,  to  the 
baseline  degradation  of  aging  engines. 


Robustness  Issues  of  the  FDI  System  Toward  Engine 
Uncertainty  Due  to  Aging 

In  the  real  engine  environment,  a  mismatch  in  the  health  condition 
between  an  operational  (aging)  engine  and  the  “nominal”  engine 
model  used  by  the  FDI  system  almost  always  exists.  It  is  well  known 
that  the  physical  engine  components  deteriorate  gradually  due  to  wear 
and  tear  on  blades  and  casing  as  an  engine  operates  over  time  [14].  In 
this  paper,  such  gradual  component  deterioration  is  referred  to  as 
“baseline  degradation”  and  is  represented  by  deviations  in  all  10  health 
parameters.  Two  baseline  conditions  used  for  FDI  performance 
evaluation  are  shown  in  Table  4.  The  FDI  system  is  applied  to  the 
nonlinear  simulation  at  these  two  baseline  conditions  for  each  of  the 
eight  scenarios  in  Table  3.  The  current  FDI  design  does  not  account 
for  the  changes  in  the  baseline  condition,  i.e.,  the  bank  of  Kalman 
filters  is  designed  based  on  the  healthy  engine  baseline.  Therefore,  if 
the  FDI  system  is  applied  to  the  nonlinear  engine  simulation  at 
baseline  condition  #2,  the  baseline  mismatch  will  impact  the  FDI 
performance.  It  should  be  noted  that  the  abrupt  health  parameter 
perturbations  in  Table  3  are  deviations  from  the  baseline  conditions  in 
Table  4.  Therefore,  a  3%  reduction  in  FAN  flow  capacity  (Scenarios  7 
and  8)  for  engine  baseline  #2  (Table  4)  means  5.2%  degradation  in 
total. 


Table  4.  Baseline  Degradations  in  %  from  the  Nominal 
Baseline  Condition _ 


Baseline  1: 
Nominal  (Healthy) 

Baseline  2: 
Degraded 

FAN  efficiency 

0 

-1.80 

FAN  flow 

0 

-2.20 

BST  efficiency 

0 

-2.00 

BST  flow 

0 

-2.20 

HPC  efficiency 

0 

-1.50  i 

HPC  flow 

0 

-1.20 

HPT  efficiency 

0 

-2.00 

HPT  flow 

0 

1.50 

LPT  efficiency 

0 

-1.20 

LPT  flow 

0 

2.00 

The  effects  of  baseline  mismatch  on  the  FDI  performance  are  shown 
in  Table  5  where  the  FDI  system  was  applied  to  the  nonlinear 
simulation  at  the  two  baseline  conditions.  The  simulation  was  run 
without  any  health  parameter  or  control  perturbations  (Scenario  1)  and 
without  any  sensor  or  actuator  faults. 

Table  5  shows  the  estimation  performance  of  the  FDI  filter  #1 
which  is  designed  to  monitor  the  XN2  sensor.  All  estimation  values 


Table  5.  Estimation  Performance  of  the  FDI  Filter  #1,  XN2 
(Simulation  Scenario  1  without  Sensor  or  Actuator  Fault) 


Average  Estimation  of  Filter  #1  (XN2) 

Nonlinear 

Sensor 

FAN 

FAN 

BST 

BST 

Baseline 

Bias 

Efficiency 

Flow 

Efficiency 

Flow 

Condition 

(%  of  trim) 

(%) 

(%)  _ 

(%> 

(%> 

|  1 

-0.03 

-0.05 

-0.11 

0.09 

0.05 

2 

-3.95 

-11.45 

-13.98 

1.37 

6.13 

The  loss  of  FDI  performance  due  to  aging  effects  can  be  partially 
recovered  by  modifying  any  of  the  following  three  parts  of  the  FDI 
system  shown  in  Fig.  7:  1)  Trim  Value  Data,  2)  Bank  of  Kalman 
Filters,  and  3)  Fault  Isolation  Logic. 


Figure  7.  Structure  of  the  FDI  System 


The  trim  value  data  contains  sensor  and  actuator  steady-state  values 
at  a  trim  condition  where  the  bank  of  Kalman  filters  is  designed.  As 
the  baseline  degradation  worsens,  the  difference  in  the  steady-state 
values  at  the  trim  point  between  the  degraded  and  healthy  engines 
increases,  causing  a  loss  of  FDI  performance.  If  the  trim  value  data  is 
updated  to  account  for  baseline  degradation,  the  initial  steady-state 
estimation  errors  can  be  eliminated.  Since  the  baseline  degradation 
progresses  gradually,  such  a  trim  value  update  can  be  performed  after 
a  number  of  flights  through  off-line  trend  monitoring  as  done  by 
Kobayashi  et  al.  [16]  and  Volponi  [17].  In  this  approach,  a  mismatch 
between  the  dynamics  of  the  operational  engine  and  the  nominal 
model  used  by  the  FDI  system  may  still  exist.  A  more  involved  option 
for  reducing  the  estimation  error  is  to  update  the  bank  of  Kalman 
filters  based  on  the  baseline  degradation.  After  updating  the  trim 
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value  data,  a  linear  model  can  be  generated  at  the  corresponding  trim 
condition.  By  designing  a  bank  of  Kalman  filters  based  on  this  linear 
model,  both  the  initial  steady-state  condition  and  the  dynamics  of  the 
FDI  system  will  match  with  those  of  the  operational  engine.  The  ease 
with  which  such  linear  model  generation  can  be  achieved  is  key  for 
making  this  approach  practical.  Another  option  for  regaining  the  lost 
FDI  performance  is  to  modify  the  fault  isolation  logic.  The  difference 
in  the  initial  steady-state  values  between  the  operational  engine  and 
the  nominal  trim  value  data  causes  an  increase  in  the  steady-state 
values  of  the  fault  indicator  signals.  By  simply  setting  the  threshold  at 
a  higher  value,  a  false  alarm  can  be  avoided.  However,  this  approach 
results  in  conservative  performance  when  the  operational  engine  is 
healthy.  Among  the  three  options  discussed  above,  the  first  option 
(updating  the  trim  value  data)  is  the  simplest  approach.  This  option 
will  be  evaluated  in  the  following  section. 


Evaluation  Results 

In  this  section,  the  performance  of  the  FDI  system  is  evaluated  by 
applying  it  to  the  nonlinear  simulation  for  the  eight  scenarios  in  Table 
3.  For  each  scenario,  the  nonlinear  simulation  is  executed  for  100 
seconds  at  the  two  baseline  conditions  shown  in  Table  4.  When  the 
FDI  system  is  applied  to  the  nonlinear  simulation  at  baseline  condition 
#2,  the  trim  value  data  is  updated,  assuming  an  updating  technique  is 
available,  so  that  the  initial  steady-state  mismatch  is  eliminated. 

A  sensor  or  actuator  bias  is  injected  as  a  step  change  when  the 
simulation  time  reaches  30  seconds.  As  previously  mentioned,  the 
FDI  performance  is  evaluated  based  on  the  minimum  sensor/actuator 
bias  magnitude  which  can  be  isolated,  and  the  accuracy  of  health 
parameter  estimates.  The  smaller  die  minimum  bias  that  can  be 
isolated,  the  better  the  performance  of  the  FDI  system  is  considered  to 
be.  However,  if  the  minimum  bias  becomes  too  small  relative  to 
sensor  noise,  the  assumption  that  one  sensor  or  actuator  may  be  biased 
at  a  time  may  no  longer  hold  since  multiple  sensors  and  actuators  may 
contain  small  biases  in  the  real  engine  environment.  Therefore,  it  is 
undesirable  to  have  an  FDI  system  which  is  overly  sensitive  to  small 
sensor  or  actuator  bias.  For  health  parameter  estimation,  the 


performance  is  considered  acceptable  if  the  average  estimation  error 
(difference)  is  less  than  0.5%. 

1)  Nominal  Performance:  Baseline  Condition  #1.  Table  6 
shows  performance  evaluation  results  when  the  FDI  system  is  applied 
to  the  nonlinear  simulation  at  baseline  condition  #1.  For  each  of  the 
eight  simulation  scenarios,  a  bias  was  injected  into  one  of  the  sensors 
or  actuators,  and  then  the  bias  with  the  smallest  magnitude  that  could 
be  isolated  by  the  FDI  system  was  determined.  The  isolated  minimum 
positive  bias  shown  in  the  table  is  in  %  of  trim  value  of  the  nominal 
baseline  condition.  It  is  desirable  to  normalize  the  bias  by  full-scale 
values  in  addition  to  trim  values.  However,  full-scale  values  for  this 
engine  model  are  currently  not  available.  The  numbers  in  parentheses 
indicate  the  Euclidian  distance  (square  root  of  sum  of  squares)  of  four 
health  parameter  estimation  errors,  each  of  which  was  averaged  over 
the  last  50  seconds  of  the  simulation.  The  entries  that  correspond  to 
cases  where  at  least  one  health  parameter  estimation  absolute  error 
was  larger  than  or  equal  to  0.5%  are  shaded.  It  should  be  noted  that 
the  health  parameter  estimation  accuracy  of  each  of  the  eight  sensor 
FDI  filters  is  independent  of  a  bias  in  the  corresponding  sensor.  No 
false  alarms  were  generated  on  any  simulation  scenario  with 
sensor/actuator  bias  (88  cases)  or  without  sensor/actuator  bias  (8 
scenarios). 

From  Table  6,  it  is  observed  that  the  magnitude  of  the  minimum 
isolated  bias  for  individual  sensors  and  actuators  varies  slightly  with 
the  simulation  scenario.  However,  apparent  variations  in  bias 
magnitude  can  be  observed  between  different  sensors  and  actuators. 
For  instance,  the  bias  in  the  XN25  sensor  can  be  isolated  at  low 
magnitude  while  the  minimum  bias  that  can  be  isolated  in  the  A16 
actuator  is  quite  large.  The  performance  variations  among  the  FDI 
filters  are  considered  to  be  mainly  due  to  the  uniqueness  of  the 
information  provided  by  the  sensors  and  actuators.  During  the  course 
of  the  performance  evaluation,  it  was  found  that  the  following  pairs  of 
FDI  filters  were  difficult  to  isolate  from  each  other:  T56  and  WF36, 
PS15  and  A16,  and  PS56  and  A8.  Particularly,  in  the  cases  where 
either  PS15  or  A16  is  biased,  the  two  FDI  filters  focused  on  these 


Table  6.  Performance  of  the  FDI  System  Applied  to  Nonlinear  Simulation  at  Baseline  Condition  #1 
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parameters  retain  low  fault  indicator  signals  until  the  bias  magnitude 
becomes  very  large  (see  Table  6).  A  possible  approach  to  handle  such 
a  problem  is  to  utilize  additional  information,  besides  the  sensor 
estimation  error,  in  the  fault  decision  making  process.  Although  two 
filters  generate  small  sensor  estimation  errors,  it  was  found  that  the 
“wrong”  filter  usually  generates  health  parameter  estimates  that  are 
beyond  the  expected  linear  range.  For  instance,  in  scenario  #1,  all  FDI 
filters  except  for  the  PS  15  and  A16  filters  exceed  the  detection 
threshold  when  the  bias  in  PS15  is  1.5%.  With  this  bias  magnitude, 
the  two  filters  retain  low  residuals;  however,  the  A16  filter  generates  a 
health  parameter  estimate  above  5.0%,  which  is  considered  well 
beyond  the  linear  range.  By  putting  some  bounds  on  health  parameter 
estimates,  any  filter  which  generates  estimated  values  beyond  those 
bounds  could  be  penalized  when  the  fault  indicator  signal  is  computed. 

The  difficulty  of  accurately  estimating  health  parameters  increases 
as  the  magnitude  of  the  step  perturbation  in  these  parameters 
(component  fault)  increases.  For  most  of  the  FDI  filters,  the  health 
parameter  estimates  are  acceptable  except  for  scenario  7.  Scenario  7 
can  be  considered  a  borderline  case  where  the  estimation  performance 
of  the  FDI  filters  starts  to  deviate  from  the  acceptable  level.  FDI  filter 
#1  (XN2)  generates  at  least  one  health  parameter  estimation  absolute 
error  above  0.5%  in  scenarios  6  and  8.  The  low-spool  speed  provides 
essential  information  for  estimating  health  parameters;  therefore  the 
cases  where  the  XN2  sensor  is  biased  are  very  challenging  in  terms  of 
obtaining  accurate  estimation  of  health  parameters. 

21  FDI  Performance  Recovery:  Baseline  Condition  #2. 

Table  7  shows  performance  evaluation  results  when  the  FDI  system  is 
applied  to  the  nonlinear  simulation  at  baseline  condition  #2.  As 
discussed  earlier,  the  trim  value  data  is  updated  based  on  the  new 
baseline  condition  so  that  the  initial  steady-state  mismatch  is 
eliminated.  No  false  alarms  were  generated  on  any  simulation 
scenario  with  sensor/actuator  bias  (88  cases)  or  without 
sensor/actuator  bias  (8  scenarios). 

It  can  be  observed  that  the  magnitude  of  the  minimum  isolated  bias 
is  very  close  to  the  previous  case,  indicating  that  the  loss  of 


sensor/actuator  FDI  performance  due  to  mismatch  in  the  baseline 
condition  can  be  recovered  by  updating  the  trim  value  data.  However, 
the  accuracy  of  health  parameter  estimation  is  not  recovered.  The 
estimation  errors  become  very  large  when  health  parameter  step 
perturbations  exceed  2%  (scenarios  5  through  8).  Although  the  initial 
steady-state  values  were  made  to  match,  the  new  steady-state  values 
after  the  perturbations  do  not  match  because  of  the  difference  in  the 
dynamics  (specifically,  steady-state  gain)  between  the  nonlinear 
simulation  and  the  FDI  system.  This  difference  is  causing  the  health 
parameter  estimation  errors.  As  discussed  before,  when  there  is  a 
mismatch  in  the  steady-state  condition,  the  mismatch  is  “smeared”  to 
the  four  health  parameters  being  estimated.  Thus,  the  four  health 
parameters  may  no  longer  represent  the  actual  health  parameters. 
Instead,  they  become  “tuning”  parameters.  A  Kalman  filter  tunes 
these  four  health  parameters  so  that  its  sensor  estimates  will  match 
with  the  outputs  of  the  nonlinear  simulation. 

As  seen  in  this  example,  large  health  parameter  estimation  errors  do 
not  necessarily  result  in  large  sensor  estimation  errors.  Therefore, 
determining  the  confidence  in  estimated  health  parameters,  which  is 
currently  based  on  sensor  estimation  errors,  is  always  a  challenging 
issue  in  the  health  estimation  problem.  With  the  current  FDI  design, 
component  faults  can  be  inferred  from  changes  in  the  estimated  health 
parameters;  however,  the  corresponding  damage  level  cannot  be 
estimated  accurately.  As  mentioned  previously,  one  possible  approach 
to  improve  the  estimation  accuracy  is  to  update  the  bank  of  Kalman 
filters  based  on  the  baseline  degradation. 


Evaluation  Summary 

The  FDI  system  was  also  evaluated  for  negative  biases  in  each 
sensor  and  actuator.  The  results  were  very  similar  to  the  positive  bias 
cases  in  terms  of  the  minimum  magnitude  of  isolated  biases  and  health 
parameter  estimation  accuracy.  Again,  the  FDI  system  successfully 
isolated  sensor  and  actuator  faults  without  generating  false  alarms  for 
all  simulation  cases.  In  a  total  of  368  simulation  fault  cases  (176  cases 
for  each  bias  direction  and  16  no-bias  cases)  investigated  in  this  paper, 
no  false  alarm  was  generated. 


Table  7.  Performance  of  the  FDI  System  Applied  to  Nonlinear  Simulation  at  Baseline  Condition  #2 
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CONCLUSIONS 

An  approach  utilizing  a  bank  of  Kalman  filters  with  an  augmented 
state  vector  was  developed  for  detection  and  isolation  of  sensor  and 
actuator  faults  in  conjunction  with  the  detection  of  component  faults. 
This  methodology  was  applied  to  an  aircraft  engine  simulation  and 
demonstrated  the  capability  to  successfully  detect  and  isolate  sensor 
and  actuator  bias  errors  even  in  the  presence  of  engine  component 
faults  caused  by  incidents  such  as  foreign  object  damage  (FOD).  An 
approach  to  maintain  the  robustness  of  the  fault  detection  and  isolation 
(FDI)  system  even  in  the  presence  of  engine  baseline  degradation  was 
presented.  This  approach  was  demonstrated  through  an  example 
where  the  FDI  system  was  applied  to  the  nonlinear  engine  simulation 
at  a  degraded  baseline  condition.  Since  the  bank  of  Kalman  filters  was 
designed  based  on  the  healthy  (nominal)  baseline  condition,  the 
baseline  degradation  of  the  engine  simulation  caused  mismatches  in 
both  the  initial  steady-state  condition  and  the  dynamics.  The  initial 
steady-state  mismatch  was  eliminated  by  updating  the  trim  value  data. 
In  the  presence  of  errors  due  to  mismatched  model  dynamics,  the 
Kalman  filters  used  the  four  health  parameters  as  “tuners”  so  that 
sensor  estimates  matched  the  outputs  of  the  degraded  engine 
simulation.  Health  parameter  estimation  errors  became  large  because 
of  this  ‘‘tuning”  effect;  however,  low  sensor  estimation  errors  were 
retained,  and  as  a  result,  no  false  alarms  were  generated. 

For  further  improvement  of  the  FDI  system,  the  process  to  improve 
the  accuracy  of  health  parameter  estimation  in  the  presence  of  engine 
baseline  degradation  needs  to  be  investigated.  In  future  work,  the 
above  issue  will  be  considered  in  addition  to  extending  the  FDI 
capability  over  a  wider  flight  region  and  applying  the  FDI  design 
methodology  to  other  types  of  faults. 
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